tdf#160971 a11y: Add null check in AccessibleListBox::getAccessibleRole

Add a null check in `AccessibleListBox::getAccessibleRole`.

Otherwise, LO Writer crashes on exit when using the qt6 VCL
plugin with Orca running for this scenario:

1) start Writer with the qt6 VCL plugin
2) press F6 until focus is in the formatting toolbar
3) use tab key to get to the editable comboboxes
4) use up/down keys to change entries
5) use Alt+Down to expand combobox
6) switch between entries using up/down keys
7) close Writer

The reason is that the window gets unset when when
`SvTreeListBox::dispose` emits the
`VclEventId::ObjectDying` event, see
`VCLXAccessibleComponent::ProcessWindowEvent`.

But then, Qt's AT-SPI adaptor wants to query the accessible
role when the `AccessibleEventId::CHILD` event is forwarded
in our Qt a11y bridge, which previously resulted in a
nullptr dereference with the below backtrace.

Just return `AccessibleRole::LIST` for the null case.

Backtrace:

1  std::__uniq_ptr_impl<WindowImpl, std::default_delete<WindowImpl>>::_M_ptr                         unique_ptr.h                  199  0x7f0c1ee0b055
2  std::unique_ptr<WindowImpl, std::default_delete<WindowImpl>>::get                                 unique_ptr.h                  470  0x7f0c1ee0b035
3  std::unique_ptr<WindowImpl, std::default_delete<WindowImpl>>::operator bool                       unique_ptr.h                  487  0x7f0c1ee4abc5
4  vcl::Window::GetStyle                                                                             window2.cxx                   989  0x7f0c1f0e594d
5  accessibility::AccessibleListBox::getAccessibleRole                                               accessiblelistbox.cxx         347  0x7f0be055205a
6  QtAccessibleWidget::role                                                                          QtAccessibleWidget.cxx        380  0x7f0c151cc242
7  AtSpiAdaptor::pathForInterface                                                                    atspiadaptor.cpp              1771 0x7f0c13a8b112
8  AtSpiAdaptor::notifyAboutDestruction                                                              atspiadaptor.cpp              1419 0x7f0c13a86e81
9  AtSpiAdaptor::notify                                                                              atspiadaptor.cpp              988  0x7f0c13a8246b
10 QSpiAccessibleBridge::notifyAccessibilityUpdate                                                   qspiaccessiblebridge.cpp      85   0x7f0c13ad9bf2
11 QAccessible::updateAccessibility                                                                  qaccessible.cpp               940  0x7f0c13a603aa
12 QtAccessibleEventListener::notifyEvent                                                            QtAccessibleEventListener.cxx 232  0x7f0c151c1363
13 comphelper::AccessibleEventNotifier::addEvent                                                     accessibleeventnotifier.cxx   256  0x7f0c270ee1b7
14 comphelper::OCommonAccessibleComponent::NotifyAccessibleEvent                                     accessiblecomponenthelper.cxx 127  0x7f0c270e95b1
15 VCLXAccessibleComponent::ProcessWindowEvent                                                       vclxaccessiblecomponent.cxx   229  0x7f0c20e80720
16 VCLXAccessibleComponent::WindowEventListener                                                      vclxaccessiblecomponent.cxx   109  0x7f0c20e7fbbe
17 VCLXAccessibleComponent::LinkStubWindowEventListener                                              vclxaccessiblecomponent.cxx   98   0x7f0c20e7f58d
18 Link<VclWindowEvent&, void>::Call                                                                 link.hxx                      111  0x7f0c1efa2898
19 vcl::Window::CallEventListeners                                                                   event.cxx                     262  0x7f0c1ef9f62e
20 vcl::Window::dispose                                                                              window.cxx                    163  0x7f0c1f0f6513
21 Control::dispose                                                                                  ctrl.cxx                      65   0x7f0c1f177a06
22 SvTreeListBox::dispose                                                                            treelistbox.cxx               1340 0x7f0c1f464d1b
23 SvTabListBox::dispose                                                                             svtabbx.cxx                   243  0x7f0c1f407a09
24 VclReferenceBase::disposeOnce                                                                     vclreferencebase.cxx          38   0x7f0c1f3a957a
25 VclPtr<vcl::Window>::disposeAndClear                                                              vclptr.hxx                    207  0x7f0c1eebfb19
26 VclBuilder::disposeBuilder                                                                        builder.cxx                   814  0x7f0c1ee96f91
27 VclBuilder::~VclBuilder                                                                           builder.cxx                   806  0x7f0c1ee96df9
28 std::default_delete<VclBuilder>::operator()                                                       unique_ptr.h                  99   0x7f0c1ef6375b
29 std::__uniq_ptr_impl<VclBuilder, std::default_delete<VclBuilder>>::reset                          unique_ptr.h                  211  0x7f0c1ef9da3c
30 std::unique_ptr<VclBuilder, std::default_delete<VclBuilder>>::reset                               unique_ptr.h                  509  0x7f0c1ef9cfcd
31 SalInstanceBuilder::~SalInstanceBuilder                                                           salvtables.cxx                7436 0x7f0c1f900b3e
32 SalInstanceBuilder::~SalInstanceBuilder                                                           salvtables.cxx                7431 0x7f0c1f900ba9
33 std::default_delete<weld::Builder>::operator()                                                    unique_ptr.h                  99   0x7f0c2490445f
34 std::__uniq_ptr_impl<weld::Builder, std::default_delete<weld::Builder>>::reset                    unique_ptr.h                  211  0x7f0c2490438c
35 std::unique_ptr<weld::Builder, std::default_delete<weld::Builder>>::reset                         unique_ptr.h                  509  0x7f0c24900e5d
36 PanelLayout::~PanelLayout                                                                         PanelLayout.cxx               76   0x7f0c24f71c06
37 SfxTemplatePanelControl::~SfxTemplatePanelControl                                                 templdlg.cxx                  163  0x7f0c24bd3d51
38 SfxTemplatePanelControl::~SfxTemplatePanelControl                                                 templdlg.cxx                  160  0x7f0c24bd3d99
39 std::default_delete<PanelLayout>::operator()                                                      unique_ptr.h                  99   0x7f0c24f1bedc
40 std::__uniq_ptr_impl<PanelLayout, std::default_delete<PanelLayout>>::reset                        unique_ptr.h                  211  0x7f0c24f1bfdc
41 std::unique_ptr<PanelLayout, std::default_delete<PanelLayout>>::reset                             unique_ptr.h                  509  0x7f0c24f1b06d
42 sfx2::sidebar::SidebarPanelBase::disposing                                                        SidebarPanelBase.cxx          86   0x7f0c24f1a1df
43 comphelper::WeakComponentImplHelperBase::dispose                                                  compbase.cxx                  26   0x7f0c2715c7a4
44 comphelper::WeakComponentImplHelper<com::sun::star::ui::XContextChangeEventListener, com::sun::star::ui::XUIElement, com::sun::star::ui::XToolPanel, com::sun::star::ui::XSidebarPanel, com::sun::star::ui::XUpdateModel>::dispose compbase.hxx        75   0x7f0c24f1b235
45 sfx2::sidebar::Panel::~Panel                                                                      Panel.cxx                     124  0x7f0c24f6fa51
46 std::destroy_at<sfx2::sidebar::Panel>                                                             stl_construct.h               88   0x7f0c24f17315
47 std::_Destroy<sfx2::sidebar::Panel>                                                               stl_construct.h               149  0x7f0c24f172f5
48 std::allocator_traits<std::allocator<void>>::destroy<sfx2::sidebar::Panel>                        alloc_traits.h                675  0x7f0c24f170ff
49 std::_Sp_counted_ptr_inplace<sfx2::sidebar::Panel, std::allocator<void>, (__gnu_cxx::_Lock_policy)2>::_M_dispose                                                       shared_ptr_base.h             613  0x7f0c24f170ff
50 std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release                                     shared_ptr_base.h             346  0x7f0c2481f0ce
51 std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count                                  shared_ptr_base.h             1071 0x7f0c2481f04a
52 std::__shared_ptr<sfx2::sidebar::Panel, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr                shared_ptr_base.h             1524 0x7f0c24f15469
53 std::__shared_ptr<sfx2::sidebar::Panel, (__gnu_cxx::_Lock_policy)2>::reset                        shared_ptr_base.h             1642 0x7f0c24f0cc84
54 sfx2::sidebar::Deck::dispose                                                                      Deck.cxx                      93   0x7f0c24f5842b
55 VclReferenceBase::disposeOnce                                                                     vclreferencebase.cxx          38   0x7f0c1f3a957a
56 VclPtr<sfx2::sidebar::Deck>::disposeAndClear                                                      vclptr.hxx                    207  0x7f0c24f0bc96
57 sfx2::sidebar::ResourceManager::disposeDecks                                                      ResourceManager.cxx           800  0x7f0c24f79791
58 sfx2::sidebar::SidebarController::disposeDecks                                                    SidebarController.cxx         250  0x7f0c24efde01
59 sfx2::sidebar::SidebarController::unregisterSidebarForFrame                                       SidebarController.cxx         212  0x7f0c24efd7e3
60 sfx2::sidebar::SidebarController::frameAction                                                     SidebarController.cxx         1619 0x7f0c24f07542
61 (anonymous namespace)::XFrameImpl::implts_sendFrameActionEvent                                    frame.cxx                     2960 0x7f0c25e25207
62 (anonymous namespace)::XFrameImpl::setComponent                                                   frame.cxx                     1457 0x7f0c25e1d8b2
63 (anonymous namespace)::XFrameImpl::close                                                          frame.cxx                     1706 0x7f0c25e20158
64 framework::Desktop::impl_closeFrames                                                              desktop.cxx                   1699 0x7f0c25e03be4
65 framework::Desktop::terminate                                                                     desktop.cxx                   205  0x7f0c25e0315b
66 framework::CloseDispatcher::implts_terminateApplication                                           closedispatcher.cxx           552  0x7f0c25c33510
67 framework::CloseDispatcher::impl_asyncCallback                                                    closedispatcher.cxx           406  0x7f0c25c326af
68 framework::CloseDispatcher::LinkStubimpl_asyncCallback                                            closedispatcher.cxx           246  0x7f0c25c30b7d
69 Link<LinkParamNone *, void>::Call                                                                 link.hxx                      111  0x7f0c1ee22718
70 vcl::EventPoster::DoEvent_Impl                                                                    evntpost.cxx                  52   0x7f0c1f8a1485
71 vcl::EventPoster::LinkStubDoEvent_Impl                                                            evntpost.cxx                  48   0x7f0c1f8a143d
72 Link<void *, void>::Call                                                                          link.hxx                      111  0x7f0c1f12d138
73 ImplHandleUserEvent                                                                               winproc.cxx                   2287 0x7f0c1f128e19
74 ImplWindowFrameProc                                                                               winproc.cxx                   2851 0x7f0c1f1257d0
75 SalFrame::CallCallback                                                                            salframe.hxx                  312  0x7f0c15240b90
76 QtInstance::ProcessEvent                                                                          QtInstance.cxx                516  0x7f0c15263e3f
77 SalUserEventList::DispatchUserEvents(bool)::$_0::operator()() const                               salusereventlist.cxx          119  0x7f0c1f8b585d
78 SalUserEventList::DispatchUserEvents                                                              salusereventlist.cxx          120  0x7f0c1f8b5704
79 QtInstance::ImplYield                                                                             QtInstance.cxx                442  0x7f0c15260541
80 QtInstance::DoYield                                                                               QtInstance.cxx                464  0x7f0c15263945
81 ImplYield                                                                                         svapp.cxx                     378  0x7f0c1f995c9c
82 Application::Yield                                                                                svapp.cxx                     466  0x7f0c1f9955ab
83 Application::Execute                                                                              svapp.cxx                     353  0x7f0c1f995342
84 desktop::Desktop::Main                                                                            app.cxx                       1615 0x7f0c28b275a9
85 ImplSVMain                                                                                        svmain.cxx                    229  0x7f0c1f9b84ae
86 SVMain                                                                                            svmain.cxx                    261  0x7f0c1f9ba4f9
87 soffice_main                                                                                      sofficemain.cxx               93   0x7f0c28bab36c
88 sal_main                                                                                          main.c                        51   0x5644eb5ffa5d
89 main                                                                                              main.c                        49   0x5644eb5ffa37

Change-Id: I3fefaed31c6557620ecbe1627d265f2065fe9747
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167475
Tested-by: Jenkins
Reviewed-by: Michael Weghorn <m.weghorn@posteo.de>

1 files changed, 6 insertions, 2 deletions

diff --git a/accessibility/source/extended/accessiblelistbox.cxx b/accessibility/source/extended/accessiblelistbox.cxx
index fb800403a302..bcb1c9f4b87c 100644
--- a/accessibility/source/extended/accessiblelistbox.cxx
+++ b/accessibility/source/extended/accessiblelistbox.cxx
@@ -343,9 +343,13 @@ namespace accessibility
     {
         ::comphelper::OExternalLockGuard aGuard( this );
 
+        VclPtr<SvTreeListBox> pListBox = getListBox();
+        if (!pListBox)
+            return AccessibleRole::LIST;
+
         //o is: return AccessibleRole::TREE;
-        bool bHasButtons = (getListBox()->GetStyle() & WB_HASBUTTONS)!=0;
-        if(!bHasButtons && (getListBox()->GetTreeFlags() & SvTreeFlags::CHKBTN))
+        bool bHasButtons = (pListBox->GetStyle() & WB_HASBUTTONS) != 0;
+        if (!bHasButtons && (pListBox->GetTreeFlags() & SvTreeFlags::CHKBTN))
             return AccessibleRole::LIST;
         else
             if (GetRoleType() == 0)